A method for detecting low-frequency, persistent, anomalous network attack behavior

Abstract

This invention provides a method for detecting low-frequency, persistent, abnormal network attack behavior, relating to the field of big data alarm information technology. The method includes: analyzing alarms from network attacks; if the number of alarms from the same attacker IP is greater than or equal to a first number; if a second number of time intervals are identical, an alarm is triggered; if alarm data from the same victim IP and alarm data from the same attacker IP exceed the first number within n days, detection is performed; during detection, the alarm generation time of the alarm data is extracted, possible standard deviations are calculated, and the frequency of identical standard deviations is counted; when the frequency reaches a third number, an alarm is generated; alarm data meeting preset conditions is extracted, merged, and compared with existing data; serialized and stored in Elasticsearch. This invention can quickly and efficiently filter out low-frequency attack information, playing a significant role in protecting network and system security while saving time and costs.

Description

Technical Field

[0001] This invention relates to the field of big data alarm information technology, specifically to a method for detecting low-frequency, persistent abnormal network attack behavior. Background Technology

[0002] Big data, also known as massive data, refers to data volumes so large that mainstream software tools cannot capture, manage, process, and organize it into information that helps businesses make more proactive decisions within a reasonable timeframe. Big data encompasses two aspects: data collection and data analysis. Alarm notifications are automatic alerts sent when the system detects anomalies or reaches preset conditions. They are typically categorized into email alerts, SMS alerts, and telephone alerts, primarily used to notify users of specific events or changes in status.

[0003] Instrumentation data needs to be protected for network and system security. Alarm data received over a long period of time and at a fast pace needs to be effectively filtered. However, there is currently no efficient detection method for low-frequency continuous attacks on the system. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of the prior art by providing a method for detecting low-frequency, persistent, abnormal network attack behavior, thereby solving the problem of detecting low-frequency, persistent attacks on systems.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] This invention provides a method for detecting low-frequency, persistent, abnormal network attack behavior, the method comprising:

[0007] Analyze alarms from different sources in network attacks. With a period of n days, if the number of alarms from the same attacker IP is greater than or equal to the first preset number in the past n days, check the time interval of all alarms from that IP. If there are a second preset number of time intervals that are the same, then trigger an alarm. n is 7 or 30. The first preset number is a natural number greater than or equal to 10, and the second preset number is a natural number greater than or equal to 4.

[0008] Extract the attacker's IP and victim's IP from the collected data. Verify whether the number of alarm data entries for the same victim's IP and the same attacker's IP within n days exceeds the first preset number. If they exceed the first preset number, a detection is performed. During the detection, extract the alarm generation time from the multiple alarm data entries. Calculate the difference between every two timestamps in ascending order as the possible standard occurrence difference. Count the number of times the same standard occurrence difference occurs. When the count reaches the third preset number, generate an alarm through filtering. The third preset number is a natural number greater than or equal to 5.

[0009] The collected data is filtered by the filter component to extract alarm data that meets the preset conditions, and then merged and compared with the existing data in the database. Finally, the resulting data is serialized and stored in Elasticsearch.

[0010] Optionally, the first preset number is 10.

[0011] Optionally, the second preset number is 4.

[0012] Optionally, the third preset number is 5.

[0013] Optionally, when viewing the alarm time interval, the time interval tolerance is 5 minutes.

[0014] Alternatively, a greedy algorithm can be used to find the same time interval.

[0015] The beneficial effects of this invention include:

[0016] The method for detecting low-frequency, persistent, abnormal network attack behavior provided by this invention includes: analyzing alarms from different sources in the network attack; taking n days as a period; if the number of alarms from the same attacker IP is greater than or equal to a first preset number within the past n days; checking the time intervals of all alarms from that IP; if there are a second preset number of identical time intervals, then triggering an alarm; where n is 7 or 30, the first preset number is a natural number greater than or equal to 10, and the second preset number is a natural number greater than or equal to 4; extracting the attacker IP and victim IP from the collected data; and verifying whether the number of alarm data entries for the same victim IP within the past n days exceeds the first preset number and the number of alarm data entries for the same attacker IP, respectively. If the number exceeds a first preset number, a detection process is initiated. During detection, the generation time of multiple retrieved alarm data is extracted. These timestamps are then calculated in ascending order as possible standard occurrence differences. The frequency of identical standard occurrence differences is counted. When the count reaches a third preset number (a natural number greater than or equal to 5), an alarm is generated through filtering. The collected data is then filtered using a filter component to extract alarm data that meets preset conditions. These data are merged and compared with existing data in the database. Finally, the serialized data is stored in Elasticsearch. This invention can quickly and efficiently filter out low-frequency attack information, playing a significant role in network and system security protection while saving time and costs, thus contributing to enterprise development. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating the method for detecting low-frequency, persistent, abnormal network attack behavior provided by an embodiment of the present invention is shown. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Big data, also known as massive data, refers to data volumes so large that mainstream software tools cannot capture, manage, process, and organize it into information that helps businesses make more proactive decisions within a reasonable timeframe. Big data encompasses two aspects: data acquisition and data analysis. Alarm notifications are automatic alerts sent when the system detects anomalies or reaches preset conditions. They are typically categorized as email alerts, SMS alerts, and telephone alerts, primarily used to notify users of specific events or changes in status. Instrumentation data requires network and system security. Effective filtering of alarm data received rapidly over long periods is necessary; however, there are currently no efficient methods for detecting low-frequency, persistent attacks on the system.

[0021] The purpose of this invention is to provide an algorithm for detecting low-frequency, persistent, abnormal network attack behavior. This algorithm can intercept low-frequency attacks through certain detection methods, thereby making the system more secure.

[0022] Figure 1 A flowchart illustrating the method for detecting low-frequency, persistent, abnormal network attack behavior provided by an embodiment of the present invention is shown. Figure 1 As shown, the present invention provides a method for detecting low-frequency, persistent, abnormal network attack behavior, the method comprising:

[0023] Step 11: Analyze alarms from different sources in the network attack. With a period of n days, if the number of alarms from the same attacker IP is greater than or equal to the first preset number in the past n days, check the time interval of all alarms from that IP. If there are a second preset number of time intervals that are the same, then trigger an alarm.

[0024] Where n is 7 or 30, the first preset number is a natural number greater than or equal to 10, and the second preset number is a natural number greater than or equal to 4. Optionally, the first preset number is 10, and the second preset number is 4. Optionally, a greedy algorithm is used when searching for the same time interval. A greedy algorithm is an algorithmic strategy that takes the best (or most advantageous) decision in the current state at each step, aiming to achieve a globally optimal solution through locally optimal decisions. The key to a greedy algorithm is to construct a suitable greedy strategy, and the choice of this strategy must have no aftereffect, that is, the process before a certain state will not affect the subsequent state, and only depends on the current state. A greedy algorithm does not guarantee that it will obtain the optimal solution, but in some problems, the solution of the greedy algorithm is close enough to the optimal solution or is indeed the optimal solution. Greedy algorithms are suitable for problems with optimal substructure, that is, the optimal solution of the problem contains the optimal solutions of its subproblems. Greedy algorithms are characterized by proceeding step by step, often making the optimal choice based on the current situation and a certain optimization metric, without considering all possible overall scenarios. This saves a significant amount of time that would otherwise be spent exhaustively searching for the optimal solution. Optionally, when viewing the alarm time interval, the tolerance for the time interval is 5 minutes.

[0025] Step 12: Extract the attacker's IP and victim's IP from the collected data, and verify whether the number of alarm data entries for the same victim's IP and the number of alarm data entries for the same attacker's IP within n days exceed the first preset number. If they exceed the first preset number, then perform a detection.

[0026] During detection, the alarm generation time is extracted from multiple alarm data retrieved. The difference between every two timestamps is calculated in ascending order as the possible standard occurrence difference. The number of times the same standard occurrence difference occurs is counted. When the count reaches a third preset number, an alarm is generated through filtering. The third preset number is a natural number greater than or equal to 5; optionally, the third preset number is 5.

[0027] For example: 1705468800000 1705555200000 1705641600000 1705649100000 1705728000000 1705810000000 1705814300000

[0035] The time difference between alarms 1, 2, 3, 5, and 7, based on the timestamps above, is 24 hours (tolerance 5 minutes). Therefore, the differences between alarms 12, 13, 14, 23, 24, and 34 are extracted as the standard value. Then, starting from the first timestamp, the standard differences are accumulated, and it is checked whether there is any data with the same standard deviation in the current timestamp set (tolerance 5 minutes). If so, the statistic (starting from 0) is incremented by 1. When the statistic reaches 5, it indicates that the alarm meets the criteria for low-frequency persistence, and an alarm is generated through this filtering process. The analysis process is as follows:

[0036] 1705468800000 is already the first entry; since there are equal numbers, the statistic is incremented by 1. Adding 86400000 to 1705555200000 also results in equal numbers; therefore, the statistic is incremented by 1.

[0037] Adding 86400000 to 1705555200000 gives 1705641600000. Add 1. Adding 86400000 to 1705728000000 gives 1705728000000. Add 1. Adding 86400000 to 1705728000000 gives 1705814400000. The difference between 1705814300000 and 1705814400000 is within 5 minutes, so add 1. At this point, the statistical number is 5, so stop the analysis and generate an alarm through filtering. Otherwise, continue the statistics and repeat the above process.

[0038] Step 13: Filter the collected data through the filter component, extract the alarm data that meets the preset conditions, merge them, compare them with the existing data in the database, and finally store the serialized data in Elasticsearch.

[0039] In summary, this invention can quickly and efficiently filter out low-frequency attack information, playing a significant role in ensuring network and system security while saving time and costs, thus contributing to enterprise development.

[0040] The above embodiments are only for illustrating the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it. They should not be used to limit the scope of protection of the present invention. All equivalent changes or modifications made in accordance with the spirit and essence of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for detecting low-frequency, persistent, abnormal network attack behavior, characterized in that, The method includes: Analyze alarms from different sources in network attacks. With a period of n days, if the number of alarms from the same attacker IP is greater than or equal to a first preset number in the past n days, check the time interval of all alarms from that IP. If there are a second preset number of time intervals that are the same, then trigger an alarm. n is 7 or 30. The first preset number is a natural number greater than or equal to 10, and the second preset number is a natural number greater than or equal to 4. Extract the attacker's IP and victim's IP from the collected data, and verify whether the number of alarm data entries for the same victim's IP and the number of alarm data entries for the same attacker's IP within n days exceed the first preset number. If they exceed the first preset number, a detection is performed. During the detection, the alarm generation time of the multiple alarm data entries is extracted, and the difference between every two timestamps is calculated in ascending order as the possible standard occurrence difference. The number of times the same standard occurrence difference occurs is counted. When the counted number reaches the third preset number, an alarm is generated through filtering. The third preset number is a natural number greater than or equal to 5. The collected data is filtered by the filter component to extract alarm data that meets the preset conditions, and then merged and compared with the existing data in the database. Finally, the resulting data is serialized and stored in Elasticsearch.

2. The method for detecting low-frequency, persistent, abnormal network attack behavior according to claim 1, characterized in that, The first preset number is 10.

3. The method for detecting low-frequency, persistent, abnormal network attack behavior according to claim 2, characterized in that, The second preset number is 4.

4. The method for detecting low-frequency, persistent, abnormal network attack behavior according to claim 3, characterized in that, The third preset number is 5.

5. The method for detecting low-frequency, persistent, abnormal network attack behavior according to claim 1, characterized in that, When viewing the alarm time intervals, the tolerance for the time interval is 5 minutes.

6. The method for detecting low-frequency, persistent, abnormal network attack behavior according to claim 1, characterized in that, A greedy algorithm is used to find the same time interval.

Images